Overview

overview

10

Static

static

Video clip.MP4.xls

windows7-x64

10

Video clip.MP4.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Video clip.MP4.xls

  • Size

    1.0MB

  • Sample

    221123-qxdh8aab2z

  • MD5

    121e603042747acbd8d1fb2c55eaf080

  • SHA1

    4a3d57363b240fd6644d9bc0f6abca7ec9cf3992

  • SHA256

    e33e207971d05a656690c2ebd86e3f090f3e50d37b16320a69bc5c92f4402cd5

  • SHA512

    d18c5dd7c620ab6827547bdf671cae9ae7809d2399650c45eb85809d7b81cff3e5a6ddd38b51eb2b93acd0ff400732b3a5de2325803d09ec92539e39e7c898b0

  • SSDEEP

    24576:tr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXX9mur5XXXXXXXXXXXXUXXXXXXXSXXXXXo:UPTKo

Score
10/10
formbookdo25ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

do25

Decoy

nickifarina.site

nfptrwge.bar

nobreemporio.com

split-acres.com

sharingservice-act.com

nakedinktees.shop

zhensheng1988.com

ipiton.com

liftoffdigitalmarketing.com

karen.cool

theprotestantchurch.com

shirhadarr.com

azdtwp.com

comzestdent.com

jnsjh.com

in-heat-cool.com

dfefej.top

tumingchun.com

eisei-shouji.tokyo

sparecreeping.com

Targets

    • Target

      Video clip.MP4.xls

    • Size

      1.0MB

    • MD5

      121e603042747acbd8d1fb2c55eaf080

    • SHA1

      4a3d57363b240fd6644d9bc0f6abca7ec9cf3992

    • SHA256

      e33e207971d05a656690c2ebd86e3f090f3e50d37b16320a69bc5c92f4402cd5

    • SHA512

      d18c5dd7c620ab6827547bdf671cae9ae7809d2399650c45eb85809d7b81cff3e5a6ddd38b51eb2b93acd0ff400732b3a5de2325803d09ec92539e39e7c898b0

    • SSDEEP

      24576:tr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXX9mur5XXXXXXXXXXXXUXXXXXXXSXXXXXo:UPTKo

    Score
    10/10
    formbookdo25ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks